The libsoup library has a flaw where, after establishing a CONNECT tunnel through an HTTP proxy, it erroneously includes the Proxy-Authorization header in subsequent HTTPS requests sent through the tunnel to the destination server. This behavior exposes proxy credentials to the destination server, leading to potential information disclosure. The vulnerability is identified as CVE-2026-66339 and is classified under CWE-201 (Information Exposure). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

The vulnerability allows the destination HTTPS server to obtain proxy credentials that should remain confidential between the client and the proxy. This leads to information disclosure of sensitive authentication data, which could be leveraged for unauthorized proxy access or further attacks. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Red Hat advisory and libsoup project updates for patches addressing CVE-2026-66339. Until a fix is available, avoid using vulnerable versions of libsoup in scenarios involving CONNECT tunnels through HTTP proxies or consider alternative proxy configurations that do not expose credentials.